2

I have seen the Moonsols Memory Toolkit for Windows (Community Edition). It however does not support x64 memory dumping. Only its professional version can do that. Are there any free alternatives out there that do the same ? To narrow down what I am looking for I would be interested in features like -:

  • Convert a memory dump from a x64 Architecture.

  • Convert or decompress Windows 7 hibernation files.

  • Convert a Windows 7 memory dump.

I have seen a lot of free tools for x86, but for x64 its a whole different ball game.

2

Volatility supports x64 Windows 7 hibernation files as well as x64 images.

1

Have you tried Moonsols Dumpit? It is a free utility that can grab the physical memory.

http://www.moonsols.com/2011/07/18/moonsols-dumpit-goes-mainstream/

Rekall might be able to help with the acquisition piece as well.

http://www.rekall-forensic.com/index.html

  • Do they support x64 ? – Sreyan Nov 30 '14 at 9:53
  • Also do any of the allow the editing of x64 Windows hibernation files ? – Sreyan Nov 30 '14 at 10:08
  • You can download winpmem from the Rekall project for dumping Win x64 memory directly form here: github.com/google/rekall/releases/download/v1.0rc11/… – jonasl Nov 30 '14 at 14:46
  • @jonasl Just bear with me then. I use recall to dump the Winx64 memory and I analyze that using Volatility. Am I doing the right thing then ? – Sreyan Nov 30 '14 at 16:39
  • @Sreyan no Rekall is a fork (rewrite) of Volatility from Google so basically you're going to use it like Volatility – Maijin Dec 3 '14 at 11:05
0

Mandiant Redline might be helpful as well.

https://www.mandiant.com/resources/download/redline

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.